NSA and CISA co-author updated software bill of materials (SBOM)

FORT MEADE, Md. — The National Security Agency and the Cybersecurity and Infrastructure Security Agency on Wednesday published updated baseline requirements for software bills of materials, aiming to sharpen the way organizations assess supply chain risk across everything from open-source packages to artificial intelligence systems and SaaS.

The new Cybersecurity Information Sheet, “2026 Minimum Elements for a Software Bill of Materials (SBOM),” refreshes the government’s 2021 guidance from the National Telecommunications and Information Administration and folds in technical advances that have reshaped how software is built and deployed. The document is available at: https://media.defense.gov/2026/Jul/29/2003971159/-1/-1/1/CSI_2026_cisa_sbom_minimum_elements_508c.PDF

Among the notable additions are:
– SBOM Author Signature, to authenticate who generated the SBOM
– SBOM Version, to track iterations of the bill of materials itself
– Component Hash Value, to provide cryptographic integrity for listed components

The update also tightens expectations for several existing fields, including clearer definitions around the SBOM Author, more precise Component Identifiers, and better articulation of Coverage to describe how thoroughly a product’s components are represented. Smaller adjustments address data quality and alignment with current tooling and practices, such as Timestamp conventions, how to represent Component Dependency Relationships, and expectations for Distribution and Delivery of SBOMs.

CISA and NSA position the revised elements as the floor for transparency across software types, explicitly encompassing open-source, AI-enabled software, and cloud-delivered services. The guidance outlines how producers should generate SBOMs and how customers should request and use them, while noting that more complex systems may warrant additional fields beyond the minimum.

SBOMs function as an inventory of the components inside software, capturing how those parts relate to one another so that machines can parse and act on the data quickly. By standardizing a common set of fields—and strengthening trust signals like signatures and hashes—the agencies aim to make it easier for organizations to automate vulnerability mapping, dependency analysis, and response workflows at scale.

The push to normalize SBOM practices has accelerated since high-profile supply chain compromises and widespread component vulnerabilities underscored the need for visibility into upstream code. A 2021 executive order on cybersecurity directed federal agencies to advance SBOM adoption in procurement and risk management, and industry tooling has matured around formats like SPDX and CycloneDX to support generation and ingestion. The latest update is intended to keep pace with those developments and with the growing volume of third-party and open-source components in modern applications.

In practical terms, the changes could make it simpler for buyers to compare SBOMs across vendors, verify provenance, and tie listed components to external data sources, such as vulnerability feeds and exploit intelligence. For suppliers, clearer expectations reduce ambiguity in what must be provided and how often SBOMs should be refreshed, especially as software is continuously delivered.

The agencies emphasize that as new use cases appear—particularly in AI pipelines and cloud-native environments—the minimum elements will continue to evolve. For now, they urge organizations to treat SBOMs as living artifacts that feed directly into routine security decisions, from patch prioritization to incident response.

The full report and additional technical guidance are available through NSA and CISA’s public libraries:
– Report: https://media.defense.gov/2026/Jul/29/2003971159/-1/-1/1/CSI_2026_cisa_sbom_minimum_elements_508c.PDF
– NSA cybersecurity advisories: https://www.nsa.gov/Cybersecurity/Cybersecurity-Advisories-Guidance/